[ignition] Report NumberOrOddball feedback for relational comparisons.

TurboFan can indeed comsume NumberOrOddball feedback for abstract
relational comparisons, so we should just provide it from Ignition.

Drive-by-fix: Add a DCHECK to protect against abstract/strict equality
number comparison accidentially utilizing Oddball feedback.

BUG=v8:5267,v8:5400
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2518283002
Cr-Commit-Position: refs/heads/master@{#41166}

src/compiler/simplified-lowering.cc

@@ -1555,8 +1555,13 @@ class RepresentationSelector {
                        MachineRepresentation::kBit);
             if (lower()) ChangeToPureOp(node, Int32Op(node));
             return;
-          case NumberOperationHint::kNumber:
           case NumberOperationHint::kNumberOrOddball:
+            // Abstract and strict equality don't perform ToNumber conversions
+            // on Oddballs, so make sure we don't accidentially sneak in a hint
+            // with Oddball feedback here.
+            DCHECK_NE(IrOpcode::kSpeculativeNumberEqual, node->opcode());
+          // Fallthrough
+          case NumberOperationHint::kNumber:
             VisitBinop(node, CheckedUseInfoAsFloat64FromHint(hint),
                        MachineRepresentation::kBit);
             if (lower()) ChangeToPureOp(node, Float64Op(node));

src/globals.h

@@ -1253,8 +1253,9 @@ class CompareOperationFeedback {
     kNone = 0x00,
     kSignedSmall = 0x01,
     kNumber = 0x3,
-    kString = 0x4,
-    kAny = 0xf
+    kNumberOrOddball = 0x7,
+    kString = 0x8,
+    kAny = 0x1F
   };
 };
 

src/interpreter/interpreter.cc

@@ -1057,12 +1057,23 @@ void Interpreter::DoCompareOpWithFeedback(Token::Value compare_op,
       __ Bind(&lhs_is_not_number);
       {
         Node* lhs_instance_type = __ LoadInstanceType(lhs);
-        Node* lhs_type =
+        if (Token::IsOrderedRelationalCompareOp(compare_op)) {
+          Label lhs_is_not_oddball(assembler);
+          __ GotoUnless(
+              __ Word32Equal(lhs_instance_type, __ Int32Constant(ODDBALL_TYPE)),
+              &lhs_is_not_oddball);
+
+          var_type_feedback.Bind(
+              __ Int32Constant(CompareOperationFeedback::kNumberOrOddball));
+          __ Goto(&gather_rhs_type);
+
+          __ Bind(&lhs_is_not_oddball);
+        }
+
+        var_type_feedback.Bind(
             __ Select(__ IsStringInstanceType(lhs_instance_type),
                       __ Int32Constant(CompareOperationFeedback::kString),
-                      __ Int32Constant(CompareOperationFeedback::kAny));
-
-        var_type_feedback.Bind(lhs_type);
+                      __ Int32Constant(CompareOperationFeedback::kAny)));
         __ Goto(&gather_rhs_type);
       }
     }
@@ -1092,12 +1103,25 @@ void Interpreter::DoCompareOpWithFeedback(Token::Value compare_op,
         __ Bind(&rhs_is_not_number);
         {
           Node* rhs_instance_type = __ LoadInstanceType(rhs);
-          Node* rhs_type =
+          if (Token::IsOrderedRelationalCompareOp(compare_op)) {
+            Label rhs_is_not_oddball(assembler);
+            __ GotoUnless(__ Word32Equal(rhs_instance_type,
+                                         __ Int32Constant(ODDBALL_TYPE)),
+                          &rhs_is_not_oddball);
+
+            var_type_feedback.Bind(__ Word32Or(
+                var_type_feedback.value(),
+                __ Int32Constant(CompareOperationFeedback::kNumberOrOddball)));
+            __ Goto(&update_feedback);
+
+            __ Bind(&rhs_is_not_oddball);
+          }
+
+          var_type_feedback.Bind(__ Word32Or(
+              var_type_feedback.value(),
               __ Select(__ IsStringInstanceType(rhs_instance_type),
                         __ Int32Constant(CompareOperationFeedback::kString),
-                        __ Int32Constant(CompareOperationFeedback::kAny));
-          var_type_feedback.Bind(
-              __ Word32Or(var_type_feedback.value(), rhs_type));
+                        __ Int32Constant(CompareOperationFeedback::kAny))));
           __ Goto(&update_feedback);
         }
       }

src/type-feedback-vector-inl.h

@@ -126,6 +126,8 @@ CompareOperationHint CompareOperationHintFromFeedback(int type_feedback) {
       return CompareOperationHint::kSignedSmall;
     case CompareOperationFeedback::kNumber:
       return CompareOperationHint::kNumber;
+    case CompareOperationFeedback::kNumberOrOddball:
+      return CompareOperationHint::kNumberOrOddball;
     case CompareOperationFeedback::kString:
       return CompareOperationHint::kString;
     default: